PT-2019-14498 · Airbrake · Airbrake Ruby Notifier

Nbdavies · Published 2019-09-06 · Updated 2020-08-24 · CVE-2019-16060

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Airbrake Ruby notifier version 4.2.3

Description The Airbrake Ruby notifier mishandles the blacklist keys configuration option, which may lead to the disclosure of passwords to unauthorized actors.

Recommendations For Airbrake Ruby notifier version 4.2.3, update to version 4.2.4 to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-16060

GHSA-2P82-V77V-MPPR

Affected Products

Airbrake Ruby Notifier

References · 6

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/airbrake-ruby/CVE-2019-16060.yml · Exploit
• https://github.com/airbrake/airbrake-ruby/issues/468 · Patch
• https://osv.dev/vulnerability/CVE-2019-16060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16060 · Security Note
• https://osv.dev/vulnerability/GHSA-2p82-v77v-mppr · Vendor Advisory
• https://github.com/airbrake/airbrake-ruby/pull/469/commits/d29925e7838031bf7dea7016b22de52532503796 · Note